Introduction

This document describes the process to replace the vESA and vSMA when an upgrade is failing due to a small Nextroot partition. 

Background Information

Initially, virtual Email Security Appliance (vESA) and virtual Security Management Appliance (vSMA) images were built with a Nextroot partition size of less than 500 MB. Over the years, and with newer AsyncOS releases that include additional features, upgrades have required more space in this partition throughout the upgrade process. Upgrades can fail because of this partition size. This document provides details about the solution, which is to deploy a new virtual image with a 4-GB Nextroot partition. 

Related defects for ESA:Cisco bug ID CSCvy69068 and SMA: Cisco bug ID CSCvy69076

Symptoms

An older image vESA or vSMA with a Nextroot partition size of less than 500M can fail to upgrade with these errors being seen. 

...
...
...
Finding partitions... done.
Setting next boot partition to current partition as a precaution... done.
Erasing new boot partition... done.
Extracting eapp done.
Extracting scanerroot done.
Extracting splunkroot done.
Extracting savroot done.
Extracting ipasroot done.
Extracting ecroot done.
Removing unwanted files in nextroot done.
Extracting distroot
/nextroot: write failed, filesystem is full
./usr/share/misc/termcap: Write failed
./usr/share/misc/pci_vendors: Write to restore size failed
./usr/libexec/getty: Write to restore size failed
./usr/libexec/ld-elf.so.1: Write to restore size failed
./usr/lib/libBlocksRuntime.so: Write to restore size failed
./usr/lib/libBlocksRuntime.so.0: Write to restore size failed
./usr/lib/libalias.so: Write to restore size failed
./usr/lib/libarchive.so: Write to restore size failed

Solution

To ensure the virtual appliance can be upgraded, verify that the Nextroot partition size is 4 GB.

Command: ipcheck

(example.cisco.com) > ipcheck

<----- Example output (relevant section) ----->

  Root                  4GB 7%
  Nextroot 4GB 1%
  Var                   400MB 3%
  Log                   172GB 3%
  DB                    2GB 0%
  Swap                  6GB
  Mail Queue            10GB

<----- End of example output ----->

Expected output: Nextroot shows 4GB.

If the Nextroot partition is less than 4 GB, complete the applicable procedure to migrate the current virtual machine template to a newer image.

Important: Choose one path based on the appliance type: vESA uses a cluster-based migration (Steps 4-5). vSMA uses a backup-based migration (Step 6).

Step 1.

Deploy Your New vESA/vSMA

From the pre-requisites, download the virtual ESA/SMA image and deploy per the Cisco Content Security Virtual Appliance Installation Guide.

Note: The installation guide provides information about DHCP (**interfaceconfig**), setting the default gateway (**setgateway**), and loading the virtual appliance license file. Ensure the deployment is completed as instructed.

Step 2.

Licensing the New vESA/vSMA

Once the new virtual ESA or SMA has been deployed, then it is time to load the license file. For traditional licensing (versions 15.0 and prior), the license is contained within an XML file and must be loaded using the CLI. From the CLI, you use the loadlicense command and then follow the prompts to complete the license import.

If the version is anything after 15.5, you can review this article as Smart Licensing is mandatory:Activate Smart Licensing and Troubleshoot on ESA/SMA/WSA

Step 3.

Verify both appliances run the same AsyncOS version. If versions differ, run upgrade on the new appliance to match the original version before migration.

Step 4. (Only for vESA, Skip for vSMA)

Note: This step assumes there is no existing cluster. If a cluster already exists, add the new vESA to the existing cluster to copy the configuration, then remove the new appliance to start the upgrade process.

Create a New Cluster

On the original vESA, run clusterconfig to create a new cluster.

Original-ESA.example.com> clusterconfig

Do you want to join or create a cluster?
1. No, configure as standalone.
2. Create a new cluster.
3. Join an existing cluster over SSH.
4. Join an existing cluster over CCS.
[1]> 2

Enter the name of the new cluster.
[]> Cluster-1

Must all machines in the cluster communicate with each other by hostname or by IP address?
1. Communicate by IP address.
2. Communicate by hostname.
[2]> 1

What IP address should other machines use to communicate with Machine C170.local?
1. 192.0.2.10 port 22 (SSH on interface Management)
2. Enter an IP address manually
[]> 1

Other machines will communicate with Machine C195.local using IP address 192.0.2.10 port 22. You can change this by using the COMMUNICATION subcommand of the clusterconfig command.
New cluster committed: Sat Jun 08 11:45:33 2019 GMT
Creating a cluster takes effect immediately, there is no need to commit.

Cluster Cluster-1

Choose the operation you want to perform:
- ADDGROUP - Add a cluster group.
- SETGROUP - Set the group that machines are a member of.
- RENAMEGROUP - Rename a cluster group.
- DELETEGROUP - Remove a cluster group.
- REMOVEMACHINE - Remove a machine from the cluster.
- SETNAME - Set the cluster name.
- LIST - List the machines in the cluster.
- CONNSTATUS - Show the status of connections between machines in the cluster.
- COMMUNICATION - Configure how machines communicate within the cluster.
- DISCONNECT - Temporarily detach machines from the cluster.
- RECONNECT - Restore connections with machines that were previously detached.
- PREPJOIN - Prepare the addition of a new machine over CCS.
[]>

(Cluster Cluster-1)>

Step 5. (Only for vESA, Skip for vSMA)

Join Your New vESA to Your Original ESA Cluster

From the CLI on the new vESA, run clusterconfig and select Join an existing cluster to add the new vESA to the cluster configured on the original vESA.

New-ESA.example.com> clusterconfig

Do you want to join or create a cluster?
1. No, configure as standalone.
2. Create a new cluster.
3. Join an existing cluster over SSH.
4. Join an existing cluster over CCS.
[1]> 3

While joining a cluster, you will need to validate the SSH host key of the remote machine to which you are joining.  To get the public host key fingerprint of the remote host, connect to the cluster and run: logconfig -> hostkeyconfig -> fingerprint.

WARNING: All non-network settings will be lost. System will inherit the values set at the group or cluster mode for the non-network settings. Ensure that the cluster settings are compatible with your network settings (e.g. dnsconfig settings)

Exception:Centralized Policy, Virus, and Outbreak Quarantine settings are not inherited from the cluster.  These settings on this machine will remain intact.

Do you want to enable the Cluster Communication Service on esa.example.com? [N]> n

Enter the IP address of a machine in the cluster.
[]> 192.0.2.10

Enter the remote port to connect to.  This must be the normal admin ssh port, not the CCS port.
[22]>

Would you like to join this appliance to a cluster using pre-shared keys? Use this option if you have enabled two-factor authentication on the appliance. [Y]> n

Enter the name of an administrator present on the remote machine
[admin]>

Enter passphrase:
Please verify the SSH host key for 192.0.2.11:
Public host key fingerprint: 80:11:33:aa:bb:44:ee:ee:22:77:88:ff:77:88:88:bb
Is this a valid key for this host? [Y]> y

Joining cluster group Main_Group.
Joining a cluster takes effect immediately, there is no need to commit.
Cluster Cluster-1

Choose the operation you want to perform:
- ADDGROUP - Add a cluster group.
- SETGROUP - Set the group that machines are a member of.
- RENAMEGROUP - Rename a cluster group.
- DELETEGROUP - Remove a cluster group.
- REMOVEMACHINE - Remove a machine from the cluster.
- SETNAME - Set the cluster name.
- LIST - List the machines in the cluster.
- CONNSTATUS - Show the status of connections between machines in the cluster.
- COMMUNICATION - Configure how machines communicate within the cluster.
- DISCONNECT - Temporarily detach machines from the cluster.
- RECONNECT - Restore connections with machines that were previously detached.
- PREPJOIN - Prepare the addition of a new machine over CCS.
[]>

(Cluster Cluster-1)>

After the appliances are connected and synchronized, the new vESA has the same configuration as the existing vESA.

Command: clustercheck

Expected output: No inconsistencies are reported and synchronization is complete.

Step 6. (Only for vSMA, Skip for vESA)

Review prerequisites for SMA data backup in SMA Administrator Guide: Backup Prerequisites.

Run backupconfig on the appliance being replaced to schedule a backup to the newly deployed vSMA.

To start an immediate backup:

1. Log in to the original SMA CLI as admin.
2. Enterbackupconfig.
3. ChooseSchedule.
4. Enter the IP address of the new machine to transfer the data to.
5. The source SMA verifies the existence of the target SMA and makes sure the target SMA has enough space to accept the data.
6. Choose3 (Start a Single Backup Now).
7. Enter vieworstatus to verify that the backup was successfully scheduled.

Note: The duration taken for the data backup to complete would vary based on the size of data, network bandwidth, and so on.

After the backup completes, the new vSMA has received all data from the previous SMA.

To configure the new machine as the primary device, refer to SMA Administrator Guide: Configure the New Machine as the Primary Device.

Step 7.

In case you need to deploy more than one ESA/SMA, follow steps 1-6.

Related Information

Cisco Content Security Virtual Appliance Installation Guide

ESA Cluster Requirements and Setup

SMA End User Guides

Revision History

Revision	Publish Date	Comments
4.0	23-Jun-2026	Updated Tech Content, Title, Introduction, Machine Translation, Style Requirements, and Formatting.
1.0	27-May-2021	Initial Release